Skip to main content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Security Considerations in the Information System Development Life Cycle

Published

Author(s)

Timothy Grance, Joan Hash, Marc Stevens

Abstract

[Superseded by SP 800-64 Rev. 2 (October 2008): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=890097] The need to provide protection for federal information systems has been present since computers were first used. Including security early in the acquisition process for an information system will usually result in less expensive and more effective security than adding it to an operational system once it has entered service. This guide presents a framework for incorporating security into all phases of the information system development life cycle (SDLC) process, from initiation to disposal. This document is a guide to help organizations select and acquire cost-effective security controls by explaining how to include information system security requirements in the SDLC.Five phases of a general SDLC are discussed in this guide and include the following phases: initiation, acquisition/development, implementation, operations/maintenance, and disposition. Each of these five phases includes a minimum set of security steps needed to effectively incorporate security into a system during its development. An organization will either use the general SDLC described in this document or will have developed a tailored SDLC that meets their specific needs. In either case, NIST recommends that organizations incorporate the associated IT security steps of this general SDLC into their own development process. [Supersedes SP 800-64 (October 2003): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=917469]
Citation
Special Publication (NIST SP) - 800-64 Rev 1
Report Number
800-64 Rev 1

Keywords

acquisition, computer security, life cycle, procurement, request for proposal, requirement, Software Development Life Cycle (SDLC), specification, statement of work
Created June 16, 2004, Updated February 19, 2017